kata-containers Kata Containers up to 3.26.x permission assignment

Summaryinfo

A vulnerability labeled as critical has been found in kata-containers Kata Containers up to 3.26.x. Affected by this issue is some unknown functionality. Executing a manipulation can lead to permission assignment. This vulnerability is registered as CVE-2026-24834. The attack needs to be launched locally. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in kata-containers Kata Containers up to 3.26.x. It has been declared as critical. This vulnerability affects an unknown part. The manipulation with an unknown input leads to a permission assignment vulnerability. The CWE definition for the vulnerability is CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.27.0, an issue in Kata with Cloud Hypervisor allows a user of the container to modify the file system used by the Guest micro VM ultimately achieving arbitrary code execution as root in said VM. The current understanding is this doesn’t impact the security of the Host or of other containers / VMs running on that Host (note that arm64 QEMU lacks NVDIMM read-only support: It is believed that until the upstream QEMU gains this capability, a guest write could reach the image file). Version 3.27.0 patches the issue.

The advisory is available at github.com. This vulnerability was named CVE-2026-24834 since 01/27/2026. The exploitation appears to be easy. Local access is required to approach this attack. The technical details are unknown and an exploit is not available.

Upgrading to version 3.27.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Virtualization Software

Vendor

• kata-containers

Name

• Kata Containers

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion